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University at Buffalo 

Clinical Legal Education 

School of Law 
December 12, 2018 

Freedom of Information Act Appeal re: Expedited Processing 
Office of Information Policy 
United States Department of Justice 
Suite 11050 

1425 New York Avenue, NW 
Washington, DC 20530-0001 

RE: FOIA Appeal of Expedited Processing 

Request No. 18-01069-F 

Dear Sir or Madam: 

We write on behalf of the co-requestors Privacy International (“PI”), the American 
Civil Liberties Union, and the American Civil Liberties Union Foundation (together, the 
“ACLU”), and the Civil Liberties and Transparency Clinic of the University at Buffalo 
School of Law (“CLTC”), to appeal the Drug Enforcement Administration’s (“DEA”) 
agency’s September 24, 2018, decision denying expedited processing of our September 10, 
2018, Freedom of Information Act (“FOIA”) request. 

I. Background 

By letter dated September 10, 2018, PI, ACLU, and CLTC requested from the 
DEA’s copies of records relating to the agency’s use, acquisition, borrowing, sale, loan, 
research, and/or development of hacking techniques or equipment, software and/or 
technology that implements or facilitates hacking techniques. The FOIA request (attached 
hereto as Exhibit A) asked for expedited processing under 5 U.S.C. § 552(a)(6)(E). 

As of today, we have received one letter in response to our request for expedited 
processing to the DEA. The letter, from FOI/PA Unit Chief Katherine L. Myrick and dated 
September 24, 2018, denied expedited processing (attached as Exhibit B). We have received 
no documents from the agency responsive to our request, nor has the DEA cited any FOIA 
exemptions as a basis for refusing to disclose records. 

II. Basis for Appeal 

Pursuant to Department of Justice (“DOJ”) FOIA regulations, 28 C.F.R § 16.8(a), 
we hereby timely appeal the DEA’s refusal to grant expedited processing.' The DEA’s 
denial letter cites one regulatory criteria as the basis for denying expedited processing: the 
requirement to show that the requests involve an “urgency to inform the public” about 


' This appeal is timely filed within 90 days of receipt of Ms. Myrick’s letter denying our request for 
expedited processing. We received that letter on September 24, 2018. 
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federal government activity. The letter states that the DBA could not “identify a particular 
urgency to inform the public about an actual or alleged federal government activity beyond 
the public's right to know about government activities generally.” 

A. Requestors have demonstrated an “urgency to inform the public.” 

PI, the ACLU and CLTC’s detailed FOIA request amply demonstrates that there is 
an urgency to inform the public about the government’s use of hacking tools. FOIA and 
DOJ regulations require expedited processing of requests when a “compelling need” for 
information that creates an “urgency to inform the public concerning actual or alleged 
Federal Government activity” and the request is “made by a person who is primarily 
engaged in disseminating information.” 5 U.S.C. § 552(a)(6)(E); 28 C.F.R § 16.5(e)(ii). 

DOJ regulations elaborate that the requester “must establish a particular urgency .. . that 
extends beyond the public’s right to know about government activity generally.” 28 C.F.R. § 
16.5(e)(3). Importantly, DOJ regulations provide that “[t]he existence of numerous articles 
published on a given subject can be helpful to establishing the requirement that there be an 
‘urgency to inform’ the public on the topic.” Id. 

PI, ACLU, and CLTC’s request satisfies the criteria specified in the statute and DOJ 
regulations. The request demonstrates that these there is an “urgency to inform the public” 
concerning government hacking technologies and, in particular, any DEA use, acquisition, 
borrowing, sale, loan, research, and/or development of hacking techniques or equipment, 
software and/or technology that implements or facilitates hacking techniques. Indeed, the 
request includes more than eight pages of information about law enforcement agencies’ 
deployment of hacking and related social engineering techniques to access and gather 
information on computer systems. See Ex. A, at 1-10. These explanations are supported by 
numerous footnoted citations to sources and authority. Id. 

Moreover, the request demonstrates that the government’s use and misuse of hacking 
technology has created an “urgency to inform the public on the topic” by citing to 
“numerous articles on the subjecf’ published in newspapers, 28 C.F.R. § 16.5(e)(3), as well 
as recent reports from NGOs and other sources—including an report from the DOJ’s Office 
of Inspector General (“OIG”). Nearly all of these sources are from the past two years. See 
Ex. A, at n. 4-21, 31-36, 43, 51-56 and accompanying text. Additionally, numerous breaking 
news stories have recently been published on the government’s use of hacking tools. See Ex 
A, at 15-16 & 11.40. At least one of these breaking news stories resulted in an OIG 
investigation that itself was the subject of considerable media interest. See id. at 21 n. 56. In 
the short time since the request was filed, there have been yet more news stories about 
government hacking.^ All of these sources demonstrate, individually and collectively, that 


^ See, e.g., Thomas Brewster, Trump’s Immigration Cops Just Gave America’s Hottest iPhone 
Hackers Their Biggest Payday Yet, Forbes, Sep. 18, 2018, 

https://www.forbes.eom/sites/thomasbrewster/2018/09/18/ice-iust-gave-americas-hottest-iphone-hackers-their- 

biggest-pavdav-vet/#216552b04d02: Lorenzo Franceschi-Bicchierai, Malware Companies Are Finding New 
IFays to Spy on iPhones, Motherboard, Nov. 27,2018, 

https://motherboard.vice.com/en us/article/mbv7kq/malware-to-spv-hack-iphones : Joseph Cox, The FBI 
Created a Fake FedEx Website to Unmask a Cyhercriminal, Motherboard, Nov. 26, 2018, 
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there is an immediate, current, and ongoing public interest in this topic “that extends beyond 
the public’s right to know about government activity generally” 28 C.F.R. § 16.5(e)(3). 

The request elaborates specific reasons why this subject matter is of current 
exigency to the American public. Failure to obtain prompt disclosure would compromise an 
urgent interest of the general public in understanding how the government is using—and 
whether the government is misusing—a new and extraordinarily intrusive investigative 
technology. The request shows, for example, that these techniques are proliferating rapidly, 
particularly now that they are available commercially to law enforcement agencies. As the 
request explains. Privacy International has identified over 500 surveillance technology 
companies that sell products and services exclusively to government clients for law 
enforcement and intelligence-gathering purposes,^ including tools to enable hacking. 

The rapid proliferation of this technology raises grave concerns about individual 
privacy and technological security. Hacking is a particularly intrusive technology, 
permitting both remote access to systems as well as novel forms of real-time surveillance. 
See Ex. A at 7. These techniques create a significant potential for misuse, as government 
actors can weild these techniques covertly and on a wide scale. See Ex. A at 8. A single 
hacking operation can sweep up many individuals who are unrelated to a government 
investigation, potentially violating their rights to privacy and risking exposure of sensitive 
information. See Ex. A at 8. 

Similarly, the use of hacking raises concerns about device security. The 
government’s use of malware may proliferate to systems beyond the target device, and may 
lead to similar attacks by other actors. See Ex. A at 7. Given the potential for misuse of these 
tools, they should be subject to clear, public rules. See Ex. A at 8. This is especially true for 
understanding when and where a wamant is required for the government to collect 
information through the use of hacking tools. See Ex. A at 8. 

The public thus has an exigent need for information about the kinds of hacking that 
the government is engaged in and, especially, whether the DEA and other law enforcement 
agencies are using hacking technology and, especially, the internal protocols that govern the 
use of these invasive technologies by the DEA in its investigations. This information is 
critical to inform the current and urgent public debate about the wisdom and legality of these 
methods, and to inform the public about whether the public’s constitutional and statutory 
privacy interests are being violated. 

B. Requesters are “primarily engaged in disseminating information to the public.” 

PI, the ACLU, and CLTC also satisfy the second prong of the applicable test for a 
“compelling need” because they are “primarily engaged in disseminating information” 


https://motherboard.vice.com/en us/article/dSbSxk/the-fbi-created-a-fake-fedex-website-to-unmask-a- 

cvbercriminal : 

^ Privacy International, Privacy International Launches the Surveillance Industry Index & New 
Accompanying Report, Oct. 23, 2017, https://wwvy.privacvintemational.org/blog/54/privacv-international- 
launches-surveillance-industrv-index-new-accompanving-rep ort (last visited July 18, 2018). 
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within the meaning of the statute and regulation. 5 U.S.C. § 552(a)(6)(E)(v)(II); 28 C.F.R. § 
16.5(e)(ii). The request provides more than five pages of evidence to establish this point. See 
Ex. A. at 12-19. To summarize briefly, PI engages in research and litigation specifically in 
order to shine light on overreaching state and corporate surveillance. PI achieves this goal 
primarily by disseminating information it gathers to the public by publishing reports, 
websites, blog posts, and several other types of material meant for general public 
consumption. See Ex. A at 13 & n. 29-36. Similarly, the ACLU works to defend and 
preserve the individual rights and liberties guaranteed by the Constitution and laws of the 
United States by gathering and disseminating information. Indeed, obtaining information 
about government activity, analyzing that information, and widely publishing and 
disseminating that information to the press and public are critical and substantial 
components of the ACLU’s work and are among its primary activities. See Ex. A at 12-19 & 
n. 37-49. Finally, CLTC is a legal clinic that works in its own name and on behalf of clients 
to obtain and disseminate information on issues involving technology & privacy and law 
enforcement accountability, among others. See Ex. A at 24. Therefore, the requesters satisfy 
the requirement of being “primarily engaged in disseminating information.”'* 

For these reasons, there is an “urgency to inform the public” that justifies expedited 
processing, and the DEA’s denial should be reversed. 

111. Request for Relief 

For the foregoing reasons, we submit that PI, the ACLU, and CLTC are entitled to 
expedited processing. We respectfully request that you grant expedited processing and 
immediately begin processing the requested records immediately for potential release. 

Please direct all correspondence relating to this request to: 

Jonathan Manes 

Civil Liberties & Transparency Clinic 
University at Buffalo School of Law 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
(716) 645-6222 
immanes@buffalo.edu 


* Only one of the requestors needs to qualify in order for expedited processing to be required. See 
ACLUv. DOJ, 321 F. Supp. 2d at 30 n. 5 (cilmg Al-Fayecl v. CIA, 254 F.3d 300, 309 (D.C. Cir. 2001) (“[A]s 
long as one of the plaintiffs qualifies as an entity ‘primarily engaged in disseminating information,’ this 
requirement is satisfied.”). 
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Thank you for your prompt attention to this matter. 


Brett Max Kaufman 
Vera Eidelman 

American Civil Liberties Union 
Foundation 

125 Broad Street, 18th Floor 
New York, NY 10004 
bkaufman@aclu.org 
veidelman@aclu.org 


Sincerely, 



Jop^han Manes, Supervising attorney 
Alex Betschen, student attorney 
RJ McDonald, student attorney 
Colton Kells, student attorney 
Civil Liberties and Transparency Clinic 
University at Buffalo School of Law, SUNY 
507 O’Brian Hall, North Campus 
Buffalo, NY 14260-1100 
Tel: 716.645.6222 
j mmanes@buffalo.edu 


Jennifer Stisa Granick 

American Civil Liberties Union 

Foundation 

39 Drumm Street 

San Francisco, CA 94111 

Tel: 415.343.0758 

j gran i ck@ac 1 u .org 


Scarlet Kim 

Privacy International 

62 Britton Street 

London EC 1M5UY 

United Kingdom 

Tel:+44 (0)203 422 4321 

scarlet@privacyinternational.org 
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